CVE-1999-1228 Command injection in n/a
Remote attackers can execute arbitrary modem commands via injected sequences in network traffic if guard times are disabled or zero.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-1999-1228?
CVE-1999-1228 is a high-severity command injection vulnerability in n/a, published on 12 Sep 2001. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Various modems that do not implement a guard time, or are configured with a guard time of 0, can allow remote attackers to execute arbitrary modem commands such as ATH, ATH0, etc., via a "+++" sequence that appears in ICMP packets, the subject of an e-mail message, IRC commands, and others.
Which versions are affected by CVE-1999-1228?
It affects 3 products.
Products include Diamond Supra, Logicode Quicktel, Us Robotics Us Robotics.
How do I fix CVE-1999-1228?
No fix has been published for CVE-1999-1228 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-1999-1228 being exploited?
There is no known exploitation of CVE-1999-1228 in the wild and no public exploit code.
Sources
Also known as GHSA-xqv9-mm7j-xwfh.